polymarket-openclaw-ai-arbitrage-bot

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub repo is code (not a vetted official release) from an unknown username that instructs you to supply private keys and can execute trades, and the optional external decision endpoint (your-openclaw-service.example.com) could be a third‑party backend that exfiltrates secrets — ara.so looks legitimate but does not mitigate the risk, so these sources should be treated as suspicious for credential/theft or malicious behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly a crypto trading bot: it requires a Polygon wallet private key (POLYMARKET_PRIVATE_KEY), supports L1 wallet signing and API credential derivation, initializes an authenticated CLOB client, and explicitly submits market orders via the Polymarket v2 CLOB API (e.g., createAndPostMarketOrder, clobClient.createOrder). It also checks balances and manages positions. These are direct financial execution actions on a blockchain/marketplace, not generic tooling.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)